Redhat Cloudforms Management Engine vulnerabilities

CVE-2013-2068 [CRITICAL] CWE-22 CVE-2013-2068: Multiple directory traversal vulnerabilities in the AgentController in Red Hat CloudForms Management Multiple directory traversal vulnerabilities in the AgentController in Red Hat CloudForms Management Engine 2.0 allow remote attackers to create and overwrite arbitrary files via a .. (dot dot) in the filename parameter to the (1) log, (2) upload, or (3) linuxpkgs method.

CVE-2013-2050 [HIGH] CWE-89 CVE-2013-2050: SQL injection vulnerability in the miq_policy controller in Red Hat CloudForms 2.0 Management Engine SQL injection vulnerability in the miq_policy controller in Red Hat CloudForms 2.0 Management Engine (CFME) 5.1 and ManageIQ Enterprise Virtualization Manager 5.0 and earlier allows remote authenticated users to execute arbitrary SQL commands via the profile[] parameter in an explorer action.

CVE-2016-5402 [HIGH] CWE-94 CVE-2016-5402: A code injection flaw was found in the way capacity and utilization imported control files are proce A code injection flaw was found in the way capacity and utilization imported control files are processed. A remote, authenticated attacker with access to the capacity and utilization feature could use this flaw to execute arbitrary code as the user CFME runs as.

CVE-2020-14324 [CRITICAL] CWE-78 CVE-2020-14324: A high severity vulnerability was found in all active versions of Red Hat CloudForms before 5.11.7.0 A high severity vulnerability was found in all active versions of Red Hat CloudForms before 5.11.7.0. The out of band OS command injection vulnerability can be exploited by authenticated attacker while setuping conversion host through Infrastructure Migration Solution. This flaw allows attacker to execute arbitrary commands on CloudForms server.

CVE-2016-7040 [HIGH] CWE-284 CVE-2016-7040: Red Hat CloudForms Management Engine 4.1 does not properly handle regular expressions passed to the Red Hat CloudForms Management Engine 4.1 does not properly handle regular expressions passed to the expression engine via the JSON API and the web-based UI, which allows remote authenticated users to execute arbitrary shell commands by leveraging the ability to view and filter collections.

CVE-2017-7530 [HIGH] CWE-862 CVE-2017-7530: In CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1, it was found that privil In CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1, it was found that privilege check is missing when invoking arbitrary methods via filtering on VMs that MiqExpression will execute that is triggerable by API users. An attacker could use this to execute actions they should not be allowed to (e.g. destroying VMs).

CVE-2016-7071 [HIGH] CWE-285 CVE-2016-7071: It was found that the CloudForms before 5.6.2.2, and 5.7.0.7 did not properly apply permissions cont It was found that the CloudForms before 5.6.2.2, and 5.7.0.7 did not properly apply permissions controls to VM IDs passed by users. A remote, authenticated attacker could use this flaw to execute arbitrary VMs on systems managed by CloudForms if they know the ID of the VM.

CVE-2019-14894 [HIGH] CWE-20 CVE-2019-14894: A flaw was found in the CloudForms management engine version 5.10 and CloudForms management version A flaw was found in the CloudForms management engine version 5.10 and CloudForms management version 5.11, which triggered remote code execution through NFS schedule backup. An attacker logged into the management console could use this flaw to execute arbitrary shell commands on the CloudForms server as root.

CVE-2014-0087 [HIGH] CWE-264 CVE-2014-0087: The check_privileges method in vmdb/app/controllers/application_controller.rb in ManageIQ, as used i The check_privileges method in vmdb/app/controllers/application_controller.rb in ManageIQ, as used in Red Hat CloudForms Management Engine (CFME), allows remote authenticated users to bypass authorization and gain privileges by leveraging improper RBAC checking, related to the rbac_user_edit action.

CVE-2013-4172 [HIGH] CWE-94 CVE-2013-4172: The Red Hat CloudForms Management Engine 5.1 allow remote administrators to execute arbitrary Ruby c The Red Hat CloudForms Management Engine 5.1 allow remote administrators to execute arbitrary Ruby code via unspecified vectors.

CVE-2014-8164 [CRITICAL] CWE-295 CVE-2014-8164: A insecure configuration for certificate verification (http.verify_mode = OpenSSL::SSL::VERIFY_NONE) A insecure configuration for certificate verification (http.verify_mode = OpenSSL::SSL::VERIFY_NONE) may lead to verification bypass in Red Hat CloudForms 5.x.

CVE-2018-10905 [HIGH] CWE-284 CVE-2018-10905: CloudForms Management Engine (cfme) is vulnerable to an improper security setting in the dRuby compo CloudForms Management Engine (cfme) is vulnerable to an improper security setting in the dRuby component of CloudForms. An attacker with access to an unprivileged local shell could use this flaw to execute commands as a high privileged user.

CVE-2020-14296 [HIGH] CWE-918 CVE-2020-14296: Red Hat CloudForms 4.7 and 5 was vulnerable to Server-Side Request Forgery (SSRF) flaw. With the acc Red Hat CloudForms 4.7 and 5 was vulnerable to Server-Side Request Forgery (SSRF) flaw. With the access to add Ansible Tower provider, an attacker could scan and attack systems from the internal network which are not normally accessible.

CVE-2012-6685 [HIGH] CWE-776 CVE-2012-6685: Nokogiri before 1.5.4 is vulnerable to XXE attacks Nokogiri before 1.5.4 is vulnerable to XXE attacks

CVE-2013-2049 [HIGH] CWE-384 CVE-2013-2049: Red Hat CloudForms 2 Management Engine (CFME) allows remote attackers to conduct session tampering a Red Hat CloudForms 2 Management Engine (CFME) allows remote attackers to conduct session tampering attacks by leveraging use of a static secret_token.rb secret.

CVE-2019-14864 [MEDIUM] CWE-117 CVE-2019-14864: Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, i Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would discloses and collects any sensitive data.

CVE-2014-0197 [HIGH] CWE-352 CVE-2014-0197: CFME: CSRF protection vulnerability via permissive check of the referrer header CFME: CSRF protection vulnerability via permissive check of the referrer header

CVE-2017-2639 [HIGH] CWE-295 CVE-2017-2639: It was found that CloudForms does not verify that the server hostname matches the domain name in the It was found that CloudForms does not verify that the server hostname matches the domain name in the certificate when using a custom CA and communicating with Red Hat Virtualization (RHEV) and OpenShift. This would allow an attacker to spoof RHEV or OpenShift systems and potentially harvest sensitive information from CloudForms.

CVE-2016-4457 [HIGH] CWE-310 CVE-2016-4457: CloudForms Management Engine before 5.8 includes a default SSL/TLS certificate. CloudForms Management Engine before 5.8 includes a default SSL/TLS certificate.

CVE-2017-2664 [MEDIUM] CWE-284 CVE-2017-2664: CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certa CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certain methods in the rails application portion of CloudForms. An attacker with access could use a variety of methods within the rails application portion of CloudForms to escalate privileges.